Coldcard third-wave attacker moves 45% of stolen Bitcoin

Galaxy said 82% of Bitcoin stolen across all Coldcard attacks remains in the original addresses, with 18% moved in apparent laundering.

The exploiter behind the third wave of the Coldcard wallet hack has moved about 45% of their Bitcoin (BTC) haul, routing the funds through THORChain or into CoinJoin transactions, according to Galaxy Research.

In a Monday update, Galaxy said the exploiter began moving funds to Ethereum through THORChain on Sept. 2. The latest movements sent Bitcoin into CoinJoin rounds, which combine multiple users’ payments into a single transaction to make funds harder to trace.

Galaxy said the third-wave exploiter had created 293 two-of-two multisignature vaults to hold victims’ coins and was moving funds from the largest vaults in descending order of size. Funds from the 11 largest vaults have now been moved.

Read more

Cryptocurrency News

Author

  • Crystal Kim is a New York-based markets and investing reporter with more than 10 years of experience. Prior to joining Investopedia in July 2025, she covered crypto for Axios.

Crystal Kim

Crystal Kim is a New York-based markets and investing reporter with more than 10 years of experience. Prior to joining Investopedia in July 2025, she covered crypto for Axios.